diff --git a/ansible/roles/scripts/tasks/main.yml b/ansible/roles/scripts/tasks/main.yml
index 3fa8611..807ce33 100644
--- a/ansible/roles/scripts/tasks/main.yml
+++ b/ansible/roles/scripts/tasks/main.yml
@@ -16,3 +16,6 @@
     group: "{{ remote_user }}"
     mode: "0755"
   become: false
+
+- name: Clone/update meshfirmware
+  ansible.builtin.import_tasks: meshfirmware.yml
diff --git a/ansible/roles/scripts/tasks/meshfirmware.yml b/ansible/roles/scripts/tasks/meshfirmware.yml
new file mode 100644
index 0000000..ae83060
--- /dev/null
+++ b/ansible/roles/scripts/tasks/meshfirmware.yml
@@ -0,0 +1,8 @@
+---
+- name: Clone/update meshfirmware
+  ansible.builtin.git:
+    repo: https://github.com/mikecarper/meshfirmware.git
+    dest: "/home/{{ remote_user }}/meshfirmware"
+    version: main
+    update: true
+  become: false
diff --git a/ansible/upgrade.yml b/ansible/upgrade.yml
index 120f868..3885139 100644
--- a/ansible/upgrade.yml
+++ b/ansible/upgrade.yml
@@ -13,8 +13,17 @@
       ansible.builtin.apt:
         update_cache: true
         upgrade: dist
+
+    # Separate task: apt's autoremove option is not reliably honoured together with upgrade:
+    - name: apt autoremove
+      ansible.builtin.apt:
         autoremove: true
 
+    - name: Update meshfirmware
+      ansible.builtin.import_role:
+        name: scripts
+        tasks_from: meshfirmware
+
     - name: Check whether a reboot is required
       ansible.builtin.stat:
         path: /var/run/reboot-required